Bawolff

Improper neutralization of input during web page generation leads to a Stored Cross-Site Scripting (XSS) issue. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

Leafkit’s `htmlEscaped` function inadequately escapes HTML special characters when dealing with extended grapheme clusters. This occurs because the function only escapes characters if the extended grapheme clusters match. By utilizing an extended grapheme cluster containing both a special HTML character and additional characters, the escaping mechanism can be bypassed. Specifically, within HTML attributes, this can lead to Cross-Site Scripting (XSS) if a leaf variable in the attribute is controlled by a user. The issue stems from the way Swift handles strings based on extended grapheme clusters, differing from HTML’s character-based approach. The function `replacingOccurrences(of:with:)` or `replacing` may be affected, depending on the Swift version. The vulnerability can be exploited by crafting a malicious payload within an attribute, such as the `title` attribute, to inject arbitrary HTML or JavaScript code.

Name of the Vulnerable Software and Affected Versions: Mediawiki - Mobile Frontend Extension versions 1.39 through 1.43 Description: The issue affects the Mediawiki - Mobile Frontend Extension, allowing exposure of sensitive information to an unauthorized actor. This enables shared resource manipulation. Recommendations: For versions 1.39 through 1.43, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mediawiki - Visual Data Extension versions 1.39 through 1.43 Description: The issue is related to an Improper Input Validation vulnerability that allows HTTP DoS. This vulnerability affects the Mediawiki - Visual Data Extension. Recommendations: For versions 1.39 through 1.43, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper encoding or escaping of output, which allows code injection. This is a Code Injection Vulnerability in the Mediawiki CSS Extension.

The issue is related to the incorrect neutralization of input during web page creation in the includes/CommentFormatter/CommentParser.php file of MediaWiki. This can allow a remote attacker to perform cross-site scripting (XSS) attacks. The vulnerability is caused by the mishandling of the 0x1b character. An example of the exploitation is demonstrated by the `Special:RecentChanges#%1b0000000` endpoint.

The issue is related to insufficient input validation when processing shell arguments in the MediaWiki PandocUpload extension. This can be exploited by a remote attacker to execute arbitrary code by uploading a specially crafted file.

An issue in the Cargo extension for MediaWiki allows XSS to occur in Special:CargoQuery via a crafted page item when using the default format. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of a crafted page item in the `Special:CargoQuery` endpoint.

An issue was discovered in the Cargo extension for MediaWiki that allows storing javascript: URLs in URL fields, and these URLs are automatically linked.

An issue was discovered in the googleanalyticstrackurl parser function, which does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

An issue was discovered in MediaWiki where the CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated nonce, allowing an adversary to decrypt.

An issue was discovered in MediaWiki when installing with a pre-existing data directory that has weak permissions. The SQLite files are created with file mode 0644, making them world-readable to local users. These files include credentials data.

An issue in MediaWiki allows for XSS due to E-Widgets performing widget replacement in HTML attributes. This can lead to security issues because widget authors often do not expect their widgets to be executed in an HTML attribute context.

The issue allows XSS via an rss element if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true.

The issue is related to an Incorrect Access Control vulnerability that allows for bypassing re-authentication. This can be exploited by directly POSTing to the "Special:ChangeEmail" endpoint, potentially leading to account takeover, unauthorized access to protected information, and impact on data integrity.

The issue is related to the possibility of loading user JavaScript from a non-existent account, which allows anyone to create the account and perform cross-site scripting (XSS) on users loading that script. This can be exploited by a remote attacker to compromise data integrity.

The issue is related to an unsafe use of a temporary directory. By default, the LocalisationCache directory is set to the system's temporary directory, which is insecure.

The issue might allow remote attackers to bypass intended session access restrictions. This is achieved by leveraging a call to the `UserGetRights` function after `Session::getAllowedUserRights`.

The issue is related to a XSS vulnerability in the `highlightText()` function of the SearchHighlighter class, which occurs with non-default configurations.

The issue concerns a flaw in the Special:Search feature, which allows redirects to any interwiki link.